All network access shall be protected if Ansible is run in offline mode.

/reviewed-on nexedi/slapos.package!53

This reverts commit 5fe5177f

For now the mitogen don't work on 2.5 which is the version installed by more recent centos.

/reviewed-on !52

It is important to have them in case of problem analysis.

The most important thing is that Certificate has to match the Key.

The CA certificate is fully optional, so make it seen as this, and also
explain what is its purpose.

The install.sh script has to remove all software releases except the provided
ones, and they are different in various scenarios.

  VIFIB Users may still using gnet-re6stnet.yml and/or vifib-re6stnet.yml

  The existing configuration is specific to vifib so keep it separated.

  vars_files overwrites var_prompt inputs, so keep it minimal on slapos installation.

The roles vars have priority  the playbook ones (at least on 2.x):

http://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html#id18

The certificates might be  needed, so ask the user for domain name and
the certificates.

As a "safe" way to transmit the certificate use mktemp.

This functionality requires "playbook: Allow correct certificate with domain"

Thanks to using install.rc it is possible to easily select any playbook
to be used during the installation.

For most of cases the default approach, with generated certificate, is
enough, but sometimes the playbooks are used in environment, where
real certificates with domain names shall be used.

For such scenarios, prepare the system to use ansible-playbook
--extra-vars which can override the defaults.

Note that frontend requester is improved, to support case of passed or not
certificate files.

Bypasses the new inefficient module manager framework (Ansiballz) using the mitogen strategy plugin (https://github.com/dw/mitogen).

/reviewed-on nexedi/slapos.package!49

  The slapos master require that the machines access directly the apache instance on the backend,
  for authenticate the computers/software instances. This change is probably temporary considering
  that with causase this change might be dropped.

The previous usage lead to impossilibity of overriding variables defined
in role, because they were included forcibly in the tasks for
standalone-shared.

By using default Ansible apporach to role vars, they can be overriden on
playbook basis.

/reviewed-on !48

It is ansible standard and allows to set file mode.

As explained in http://docs.ansible.com/ansible/latest/template_module.html
"Leaving off the leading zero will likely have unexpected results.", so fix it.

  This change was suggested by @luke

  The current tag is broken, so we use master to validate the deployment, until we can release a new version

As frontend can be already available, but still not serving correct content
check that it returns ZMI (Zope Management Interface) before providing it
as working for the user.

As standalone-shared is for ERP5-related mainly, and those do require
old gcc version, install (in hackich way) gcc-4.9 on Debian 9.

Also gcc and g++ (and others) are set to be default as 4.9.

The hackish way is based on https://unix.stackexchange.com/questions/334888/how-install-g-4-9-on-debian-stretch

/reviewed-on !44

By allowing unittest.longMessage and adding result.content to the
test output on failure it is easier to debug issue with assertion.

As more then one type of ERP5ish software release can be build
with the playbook, make finding ipv4 more reliable.

Also, as there can be only one public IPv4 drop the playbook_name
namespace from the detected value.

As only two software releases shall be present on a box, assume that one
which is NOT apache frontend is the ERP5 one.

We have no control over how the ERP5 SR will be named, so this change
support this case.

As currently Debian 9 key on OBS is not valid, we need to update apt
information with allowing insecure repositories.

Even if repository role uses debian9-aptconf as dependency, it does not
update repository information *after* adding the repository. So just
update it.

/reviewed-on nexedi/slapos.package!42

As vars_files has higher precedence than vars_prompt, remove
re6st_registry_url and re6st_fingerprint from settings/vifib.yml.

/reviewed-on nexedi/slapos.package!40